1 /* 2 * QEMU PowerPC PowerNV (POWER8) PHB3 model 3 * 4 * Copyright (c) 2014-2020, IBM Corporation. 5 * 6 * This code is licensed under the GPL version 2 or later. See the 7 * COPYING file in the top-level directory. 8 */ 9 #include "qemu/osdep.h" 10 #include "qemu/log.h" 11 #include "qapi/visitor.h" 12 #include "qapi/error.h" 13 #include "hw/pci-host/pnv_phb3_regs.h" 14 #include "hw/pci-host/pnv_phb.h" 15 #include "hw/pci-host/pnv_phb3.h" 16 #include "hw/pci/pcie_host.h" 17 #include "hw/pci/pcie_port.h" 18 #include "hw/ppc/pnv.h" 19 #include "hw/ppc/pnv_chip.h" 20 #include "hw/irq.h" 21 #include "hw/qdev-properties.h" 22 #include "qom/object.h" 23 #include "sysemu/sysemu.h" 24 25 #define phb3_error(phb, fmt, ...) \ 26 qemu_log_mask(LOG_GUEST_ERROR, "phb3[%d:%d]: " fmt "\n", \ 27 (phb)->chip_id, (phb)->phb_id, ## __VA_ARGS__) 28 29 static PCIDevice *pnv_phb3_find_cfg_dev(PnvPHB3 *phb) 30 { 31 PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base); 32 uint64_t addr = phb->regs[PHB_CONFIG_ADDRESS >> 3]; 33 uint8_t bus, devfn; 34 35 if (!(addr >> 63)) { 36 return NULL; 37 } 38 bus = (addr >> 52) & 0xff; 39 devfn = (addr >> 44) & 0xff; 40 41 return pci_find_device(pci->bus, bus, devfn); 42 } 43 44 /* 45 * The CONFIG_DATA register expects little endian accesses, but as the 46 * region is big endian, we have to swap the value. 47 */ 48 static void pnv_phb3_config_write(PnvPHB3 *phb, unsigned off, 49 unsigned size, uint64_t val) 50 { 51 uint32_t cfg_addr, limit; 52 PCIDevice *pdev; 53 54 pdev = pnv_phb3_find_cfg_dev(phb); 55 if (!pdev) { 56 return; 57 } 58 cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc; 59 cfg_addr |= off; 60 limit = pci_config_size(pdev); 61 if (limit <= cfg_addr) { 62 /* 63 * conventional pci device can be behind pcie-to-pci bridge. 64 * 256 <= addr < 4K has no effects. 65 */ 66 return; 67 } 68 switch (size) { 69 case 1: 70 break; 71 case 2: 72 val = bswap16(val); 73 break; 74 case 4: 75 val = bswap32(val); 76 break; 77 default: 78 g_assert_not_reached(); 79 } 80 pci_host_config_write_common(pdev, cfg_addr, limit, val, size); 81 } 82 83 static uint64_t pnv_phb3_config_read(PnvPHB3 *phb, unsigned off, 84 unsigned size) 85 { 86 uint32_t cfg_addr, limit; 87 PCIDevice *pdev; 88 uint64_t val; 89 90 pdev = pnv_phb3_find_cfg_dev(phb); 91 if (!pdev) { 92 return ~0ull; 93 } 94 cfg_addr = (phb->regs[PHB_CONFIG_ADDRESS >> 3] >> 32) & 0xffc; 95 cfg_addr |= off; 96 limit = pci_config_size(pdev); 97 if (limit <= cfg_addr) { 98 /* 99 * conventional pci device can be behind pcie-to-pci bridge. 100 * 256 <= addr < 4K has no effects. 101 */ 102 return ~0ull; 103 } 104 val = pci_host_config_read_common(pdev, cfg_addr, limit, size); 105 switch (size) { 106 case 1: 107 return val; 108 case 2: 109 return bswap16(val); 110 case 4: 111 return bswap32(val); 112 default: 113 g_assert_not_reached(); 114 } 115 } 116 117 static void pnv_phb3_check_m32(PnvPHB3 *phb) 118 { 119 uint64_t base, start, size; 120 MemoryRegion *parent; 121 PnvPBCQState *pbcq = &phb->pbcq; 122 123 if (memory_region_is_mapped(&phb->mr_m32)) { 124 memory_region_del_subregion(phb->mr_m32.container, &phb->mr_m32); 125 } 126 127 if (!(phb->regs[PHB_PHB3_CONFIG >> 3] & PHB_PHB3C_M32_EN)) { 128 return; 129 } 130 131 /* Grab geometry from registers */ 132 base = phb->regs[PHB_M32_BASE_ADDR >> 3]; 133 start = phb->regs[PHB_M32_START_ADDR >> 3]; 134 size = ~(phb->regs[PHB_M32_BASE_MASK >> 3] | 0xfffc000000000000ull) + 1; 135 136 /* Check if it matches an enabled MMIO region in the PBCQ */ 137 if (memory_region_is_mapped(&pbcq->mmbar0) && 138 base >= pbcq->mmio0_base && 139 (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) { 140 parent = &pbcq->mmbar0; 141 base -= pbcq->mmio0_base; 142 } else if (memory_region_is_mapped(&pbcq->mmbar1) && 143 base >= pbcq->mmio1_base && 144 (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) { 145 parent = &pbcq->mmbar1; 146 base -= pbcq->mmio1_base; 147 } else { 148 return; 149 } 150 151 /* Create alias */ 152 memory_region_init_alias(&phb->mr_m32, OBJECT(phb), "phb3-m32", 153 &phb->pci_mmio, start, size); 154 memory_region_add_subregion(parent, base, &phb->mr_m32); 155 } 156 157 static void pnv_phb3_check_m64(PnvPHB3 *phb, uint32_t index) 158 { 159 uint64_t base, start, size, m64; 160 MemoryRegion *parent; 161 PnvPBCQState *pbcq = &phb->pbcq; 162 163 if (memory_region_is_mapped(&phb->mr_m64[index])) { 164 /* Should we destroy it in RCU friendly way... ? */ 165 memory_region_del_subregion(phb->mr_m64[index].container, 166 &phb->mr_m64[index]); 167 } 168 169 /* Get table entry */ 170 m64 = phb->ioda_M64BT[index]; 171 172 if (!(m64 & IODA2_M64BT_ENABLE)) { 173 return; 174 } 175 176 /* Grab geometry from registers */ 177 base = GETFIELD(IODA2_M64BT_BASE, m64) << 20; 178 if (m64 & IODA2_M64BT_SINGLE_PE) { 179 base &= ~0x1ffffffull; 180 } 181 size = GETFIELD(IODA2_M64BT_MASK, m64) << 20; 182 size |= 0xfffc000000000000ull; 183 size = ~size + 1; 184 start = base | (phb->regs[PHB_M64_UPPER_BITS >> 3]); 185 186 /* Check if it matches an enabled MMIO region in the PBCQ */ 187 if (memory_region_is_mapped(&pbcq->mmbar0) && 188 base >= pbcq->mmio0_base && 189 (base + size) <= (pbcq->mmio0_base + pbcq->mmio0_size)) { 190 parent = &pbcq->mmbar0; 191 base -= pbcq->mmio0_base; 192 } else if (memory_region_is_mapped(&pbcq->mmbar1) && 193 base >= pbcq->mmio1_base && 194 (base + size) <= (pbcq->mmio1_base + pbcq->mmio1_size)) { 195 parent = &pbcq->mmbar1; 196 base -= pbcq->mmio1_base; 197 } else { 198 return; 199 } 200 201 /* Create alias */ 202 memory_region_init_alias(&phb->mr_m64[index], OBJECT(phb), "phb3-m64", 203 &phb->pci_mmio, start, size); 204 memory_region_add_subregion(parent, base, &phb->mr_m64[index]); 205 } 206 207 static void pnv_phb3_check_all_m64s(PnvPHB3 *phb) 208 { 209 uint64_t i; 210 211 for (i = 0; i < PNV_PHB3_NUM_M64; i++) { 212 pnv_phb3_check_m64(phb, i); 213 } 214 } 215 216 static void pnv_phb3_lxivt_write(PnvPHB3 *phb, unsigned idx, uint64_t val) 217 { 218 uint8_t server, prio; 219 220 phb->ioda_LXIVT[idx] = val & (IODA2_LXIVT_SERVER | 221 IODA2_LXIVT_PRIORITY | 222 IODA2_LXIVT_NODE_ID); 223 server = GETFIELD(IODA2_LXIVT_SERVER, val); 224 prio = GETFIELD(IODA2_LXIVT_PRIORITY, val); 225 226 /* 227 * The low order 2 bits are the link pointer (Type II interrupts). 228 * Shift back to get a valid IRQ server. 229 */ 230 server >>= 2; 231 232 ics_write_xive(&phb->lsis, idx, server, prio, prio); 233 } 234 235 static uint64_t *pnv_phb3_ioda_access(PnvPHB3 *phb, 236 unsigned *out_table, unsigned *out_idx) 237 { 238 uint64_t adreg = phb->regs[PHB_IODA_ADDR >> 3]; 239 unsigned int index = GETFIELD(PHB_IODA_AD_TADR, adreg); 240 unsigned int table = GETFIELD(PHB_IODA_AD_TSEL, adreg); 241 unsigned int mask; 242 uint64_t *tptr = NULL; 243 244 switch (table) { 245 case IODA2_TBL_LIST: 246 tptr = phb->ioda_LIST; 247 mask = 7; 248 break; 249 case IODA2_TBL_LXIVT: 250 tptr = phb->ioda_LXIVT; 251 mask = 7; 252 break; 253 case IODA2_TBL_IVC_CAM: 254 case IODA2_TBL_RBA: 255 mask = 31; 256 break; 257 case IODA2_TBL_RCAM: 258 mask = 63; 259 break; 260 case IODA2_TBL_MRT: 261 mask = 7; 262 break; 263 case IODA2_TBL_PESTA: 264 case IODA2_TBL_PESTB: 265 mask = 255; 266 break; 267 case IODA2_TBL_TVT: 268 tptr = phb->ioda_TVT; 269 mask = 511; 270 break; 271 case IODA2_TBL_TCAM: 272 case IODA2_TBL_TDR: 273 mask = 63; 274 break; 275 case IODA2_TBL_M64BT: 276 tptr = phb->ioda_M64BT; 277 mask = 15; 278 break; 279 case IODA2_TBL_M32DT: 280 tptr = phb->ioda_MDT; 281 mask = 255; 282 break; 283 case IODA2_TBL_PEEV: 284 tptr = phb->ioda_PEEV; 285 mask = 3; 286 break; 287 default: 288 phb3_error(phb, "invalid IODA table %d", table); 289 return NULL; 290 } 291 index &= mask; 292 if (out_idx) { 293 *out_idx = index; 294 } 295 if (out_table) { 296 *out_table = table; 297 } 298 if (tptr) { 299 tptr += index; 300 } 301 if (adreg & PHB_IODA_AD_AUTOINC) { 302 index = (index + 1) & mask; 303 adreg = SETFIELD(PHB_IODA_AD_TADR, adreg, index); 304 } 305 phb->regs[PHB_IODA_ADDR >> 3] = adreg; 306 return tptr; 307 } 308 309 static uint64_t pnv_phb3_ioda_read(PnvPHB3 *phb) 310 { 311 unsigned table; 312 uint64_t *tptr; 313 314 tptr = pnv_phb3_ioda_access(phb, &table, NULL); 315 if (!tptr) { 316 /* Return 0 on unsupported tables, not ff's */ 317 return 0; 318 } 319 return *tptr; 320 } 321 322 static void pnv_phb3_ioda_write(PnvPHB3 *phb, uint64_t val) 323 { 324 unsigned table, idx; 325 uint64_t *tptr; 326 327 tptr = pnv_phb3_ioda_access(phb, &table, &idx); 328 if (!tptr) { 329 return; 330 } 331 332 /* Handle side effects */ 333 switch (table) { 334 case IODA2_TBL_LXIVT: 335 pnv_phb3_lxivt_write(phb, idx, val); 336 break; 337 case IODA2_TBL_M64BT: 338 *tptr = val; 339 pnv_phb3_check_m64(phb, idx); 340 break; 341 default: 342 *tptr = val; 343 } 344 } 345 346 /* 347 * This is called whenever the PHB LSI, MSI source ID register or 348 * the PBCQ irq filters are written. 349 */ 350 void pnv_phb3_remap_irqs(PnvPHB3 *phb) 351 { 352 ICSState *ics = &phb->lsis; 353 uint32_t local, global, count, mask, comp; 354 uint64_t baren; 355 PnvPBCQState *pbcq = &phb->pbcq; 356 357 /* 358 * First check if we are enabled. Unlike real HW we don't separate 359 * TX and RX so we enable if both are set 360 */ 361 baren = pbcq->nest_regs[PBCQ_NEST_BAR_EN]; 362 if (!(baren & PBCQ_NEST_BAR_EN_IRSN_RX) || 363 !(baren & PBCQ_NEST_BAR_EN_IRSN_TX)) { 364 ics->offset = 0; 365 return; 366 } 367 368 /* Grab local LSI source ID */ 369 local = GETFIELD(PHB_LSI_SRC_ID, phb->regs[PHB_LSI_SOURCE_ID >> 3]) << 3; 370 371 /* Grab global one and compare */ 372 global = GETFIELD(PBCQ_NEST_LSI_SRC, 373 pbcq->nest_regs[PBCQ_NEST_LSI_SRC_ID]) << 3; 374 if (global != local) { 375 /* 376 * This happens during initialization, let's come back when we 377 * are properly configured 378 */ 379 ics->offset = 0; 380 return; 381 } 382 383 /* Get the base on the powerbus */ 384 comp = GETFIELD(PBCQ_NEST_IRSN_COMP, 385 pbcq->nest_regs[PBCQ_NEST_IRSN_COMPARE]); 386 mask = GETFIELD(PBCQ_NEST_IRSN_COMP, 387 pbcq->nest_regs[PBCQ_NEST_IRSN_MASK]); 388 count = ((~mask) + 1) & 0x7ffff; 389 phb->total_irq = count; 390 391 /* Sanity checks */ 392 if ((global + PNV_PHB3_NUM_LSI) > count) { 393 phb3_error(phb, "LSIs out of reach: LSI base=%d total irq=%d", global, 394 count); 395 } 396 397 if (count > 2048) { 398 phb3_error(phb, "More interrupts than supported: %d", count); 399 } 400 401 if ((comp & mask) != comp) { 402 phb3_error(phb, "IRQ compare bits not in mask: comp=0x%x mask=0x%x", 403 comp, mask); 404 comp &= mask; 405 } 406 /* Setup LSI offset */ 407 ics->offset = comp + global; 408 409 /* Setup MSI offset */ 410 pnv_phb3_msi_update_config(&phb->msis, comp, count - PNV_PHB3_NUM_LSI); 411 } 412 413 static void pnv_phb3_lsi_src_id_write(PnvPHB3 *phb, uint64_t val) 414 { 415 /* Sanitize content */ 416 val &= PHB_LSI_SRC_ID; 417 phb->regs[PHB_LSI_SOURCE_ID >> 3] = val; 418 pnv_phb3_remap_irqs(phb); 419 } 420 421 static void pnv_phb3_rtc_invalidate(PnvPHB3 *phb, uint64_t val) 422 { 423 PnvPhb3DMASpace *ds; 424 425 /* Always invalidate all for now ... */ 426 QLIST_FOREACH(ds, &phb->dma_spaces, list) { 427 ds->pe_num = PHB_INVALID_PE; 428 } 429 } 430 431 432 static void pnv_phb3_update_msi_regions(PnvPhb3DMASpace *ds) 433 { 434 uint64_t cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3]; 435 436 if (cfg & PHB_PHB3C_32BIT_MSI_EN) { 437 if (!memory_region_is_mapped(&ds->msi32_mr)) { 438 memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr), 439 0xffff0000, &ds->msi32_mr); 440 } 441 } else { 442 if (memory_region_is_mapped(&ds->msi32_mr)) { 443 memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr), 444 &ds->msi32_mr); 445 } 446 } 447 448 if (cfg & PHB_PHB3C_64BIT_MSI_EN) { 449 if (!memory_region_is_mapped(&ds->msi64_mr)) { 450 memory_region_add_subregion(MEMORY_REGION(&ds->dma_mr), 451 (1ull << 60), &ds->msi64_mr); 452 } 453 } else { 454 if (memory_region_is_mapped(&ds->msi64_mr)) { 455 memory_region_del_subregion(MEMORY_REGION(&ds->dma_mr), 456 &ds->msi64_mr); 457 } 458 } 459 } 460 461 static void pnv_phb3_update_all_msi_regions(PnvPHB3 *phb) 462 { 463 PnvPhb3DMASpace *ds; 464 465 QLIST_FOREACH(ds, &phb->dma_spaces, list) { 466 pnv_phb3_update_msi_regions(ds); 467 } 468 } 469 470 void pnv_phb3_reg_write(void *opaque, hwaddr off, uint64_t val, unsigned size) 471 { 472 PnvPHB3 *phb = opaque; 473 bool changed; 474 475 /* Special case configuration data */ 476 if ((off & 0xfffc) == PHB_CONFIG_DATA) { 477 pnv_phb3_config_write(phb, off & 0x3, size, val); 478 return; 479 } 480 481 /* Other registers are 64-bit only */ 482 if (size != 8 || off & 0x7) { 483 phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d", 484 off, size); 485 return; 486 } 487 488 /* Handle masking & filtering */ 489 switch (off) { 490 case PHB_M64_UPPER_BITS: 491 val &= 0xfffc000000000000ull; 492 break; 493 case PHB_Q_DMA_R: 494 /* 495 * This is enough logic to make SW happy but we aren't actually 496 * quiescing the DMAs 497 */ 498 if (val & PHB_Q_DMA_R_AUTORESET) { 499 val = 0; 500 } else { 501 val &= PHB_Q_DMA_R_QUIESCE_DMA; 502 } 503 break; 504 /* LEM stuff */ 505 case PHB_LEM_FIR_AND_MASK: 506 phb->regs[PHB_LEM_FIR_ACCUM >> 3] &= val; 507 return; 508 case PHB_LEM_FIR_OR_MASK: 509 phb->regs[PHB_LEM_FIR_ACCUM >> 3] |= val; 510 return; 511 case PHB_LEM_ERROR_AND_MASK: 512 phb->regs[PHB_LEM_ERROR_MASK >> 3] &= val; 513 return; 514 case PHB_LEM_ERROR_OR_MASK: 515 phb->regs[PHB_LEM_ERROR_MASK >> 3] |= val; 516 return; 517 case PHB_LEM_WOF: 518 val = 0; 519 break; 520 } 521 522 /* Record whether it changed */ 523 changed = phb->regs[off >> 3] != val; 524 525 /* Store in register cache first */ 526 phb->regs[off >> 3] = val; 527 528 /* Handle side effects */ 529 switch (off) { 530 case PHB_PHB3_CONFIG: 531 if (changed) { 532 pnv_phb3_update_all_msi_regions(phb); 533 } 534 /* fall through */ 535 case PHB_M32_BASE_ADDR: 536 case PHB_M32_BASE_MASK: 537 case PHB_M32_START_ADDR: 538 if (changed) { 539 pnv_phb3_check_m32(phb); 540 } 541 break; 542 case PHB_M64_UPPER_BITS: 543 if (changed) { 544 pnv_phb3_check_all_m64s(phb); 545 } 546 break; 547 case PHB_LSI_SOURCE_ID: 548 if (changed) { 549 pnv_phb3_lsi_src_id_write(phb, val); 550 } 551 break; 552 553 /* IODA table accesses */ 554 case PHB_IODA_DATA0: 555 pnv_phb3_ioda_write(phb, val); 556 break; 557 558 /* RTC invalidation */ 559 case PHB_RTC_INVALIDATE: 560 pnv_phb3_rtc_invalidate(phb, val); 561 break; 562 563 /* FFI request */ 564 case PHB_FFI_REQUEST: 565 pnv_phb3_msi_ffi(&phb->msis, val); 566 break; 567 568 /* Silent simple writes */ 569 case PHB_CONFIG_ADDRESS: 570 case PHB_IODA_ADDR: 571 case PHB_TCE_KILL: 572 case PHB_TCE_SPEC_CTL: 573 case PHB_PEST_BAR: 574 case PHB_PELTV_BAR: 575 case PHB_RTT_BAR: 576 case PHB_RBA_BAR: 577 case PHB_IVT_BAR: 578 case PHB_FFI_LOCK: 579 case PHB_LEM_FIR_ACCUM: 580 case PHB_LEM_ERROR_MASK: 581 case PHB_LEM_ACTION0: 582 case PHB_LEM_ACTION1: 583 break; 584 585 /* Noise on anything else */ 586 default: 587 qemu_log_mask(LOG_UNIMP, "phb3: reg_write 0x%"PRIx64"=%"PRIx64"\n", 588 off, val); 589 } 590 } 591 592 uint64_t pnv_phb3_reg_read(void *opaque, hwaddr off, unsigned size) 593 { 594 PnvPHB3 *phb = opaque; 595 PCIHostState *pci = PCI_HOST_BRIDGE(phb->phb_base); 596 uint64_t val; 597 598 if ((off & 0xfffc) == PHB_CONFIG_DATA) { 599 return pnv_phb3_config_read(phb, off & 0x3, size); 600 } 601 602 /* Other registers are 64-bit only */ 603 if (size != 8 || off & 0x7) { 604 phb3_error(phb, "Invalid register access, offset: 0x%"PRIx64" size: %d", 605 off, size); 606 return ~0ull; 607 } 608 609 /* Default read from cache */ 610 val = phb->regs[off >> 3]; 611 612 switch (off) { 613 /* Simulate venice DD2.0 */ 614 case PHB_VERSION: 615 return 0x000000a300000005ull; 616 case PHB_PCIE_SYSTEM_CONFIG: 617 return 0x441100fc30000000; 618 619 /* IODA table accesses */ 620 case PHB_IODA_DATA0: 621 return pnv_phb3_ioda_read(phb); 622 623 /* Link training always appears trained */ 624 case PHB_PCIE_DLP_TRAIN_CTL: 625 if (!pci_find_device(pci->bus, 1, 0)) { 626 return 0; 627 } 628 return PHB_PCIE_DLP_INBAND_PRESENCE | PHB_PCIE_DLP_TC_DL_LINKACT; 629 630 /* FFI Lock */ 631 case PHB_FFI_LOCK: 632 /* Set lock and return previous value */ 633 phb->regs[off >> 3] |= PHB_FFI_LOCK_STATE; 634 return val; 635 636 /* DMA read sync: make it look like it's complete */ 637 case PHB_DMARD_SYNC: 638 return PHB_DMARD_SYNC_COMPLETE; 639 640 /* Silent simple reads */ 641 case PHB_PHB3_CONFIG: 642 case PHB_M32_BASE_ADDR: 643 case PHB_M32_BASE_MASK: 644 case PHB_M32_START_ADDR: 645 case PHB_CONFIG_ADDRESS: 646 case PHB_IODA_ADDR: 647 case PHB_RTC_INVALIDATE: 648 case PHB_TCE_KILL: 649 case PHB_TCE_SPEC_CTL: 650 case PHB_PEST_BAR: 651 case PHB_PELTV_BAR: 652 case PHB_RTT_BAR: 653 case PHB_RBA_BAR: 654 case PHB_IVT_BAR: 655 case PHB_M64_UPPER_BITS: 656 case PHB_LEM_FIR_ACCUM: 657 case PHB_LEM_ERROR_MASK: 658 case PHB_LEM_ACTION0: 659 case PHB_LEM_ACTION1: 660 break; 661 662 /* Noise on anything else */ 663 default: 664 qemu_log_mask(LOG_UNIMP, "phb3: reg_read 0x%"PRIx64"=%"PRIx64"\n", 665 off, val); 666 } 667 return val; 668 } 669 670 static const MemoryRegionOps pnv_phb3_reg_ops = { 671 .read = pnv_phb3_reg_read, 672 .write = pnv_phb3_reg_write, 673 .valid.min_access_size = 1, 674 .valid.max_access_size = 8, 675 .impl.min_access_size = 1, 676 .impl.max_access_size = 8, 677 .endianness = DEVICE_BIG_ENDIAN, 678 }; 679 680 static int pnv_phb3_map_irq(PCIDevice *pci_dev, int irq_num) 681 { 682 /* Check that out properly ... */ 683 return irq_num & 3; 684 } 685 686 static void pnv_phb3_set_irq(void *opaque, int irq_num, int level) 687 { 688 PnvPHB3 *phb = opaque; 689 690 /* LSI only ... */ 691 if (irq_num > 3) { 692 phb3_error(phb, "Unknown IRQ to set %d", irq_num); 693 } 694 qemu_set_irq(phb->qirqs[irq_num], level); 695 } 696 697 static bool pnv_phb3_resolve_pe(PnvPhb3DMASpace *ds) 698 { 699 uint64_t rtt, addr; 700 uint16_t rte; 701 int bus_num; 702 703 /* Already resolved ? */ 704 if (ds->pe_num != PHB_INVALID_PE) { 705 return true; 706 } 707 708 /* We need to lookup the RTT */ 709 rtt = ds->phb->regs[PHB_RTT_BAR >> 3]; 710 if (!(rtt & PHB_RTT_BAR_ENABLE)) { 711 phb3_error(ds->phb, "DMA with RTT BAR disabled !"); 712 /* Set error bits ? fence ? ... */ 713 return false; 714 } 715 716 /* Read RTE */ 717 bus_num = pci_bus_num(ds->bus); 718 addr = rtt & PHB_RTT_BASE_ADDRESS_MASK; 719 addr += 2 * ((bus_num << 8) | ds->devfn); 720 if (dma_memory_read(&address_space_memory, addr, &rte, 721 sizeof(rte), MEMTXATTRS_UNSPECIFIED)) { 722 phb3_error(ds->phb, "Failed to read RTT entry at 0x%"PRIx64, addr); 723 /* Set error bits ? fence ? ... */ 724 return false; 725 } 726 rte = be16_to_cpu(rte); 727 728 /* Fail upon reading of invalid PE# */ 729 if (rte >= PNV_PHB3_NUM_PE) { 730 phb3_error(ds->phb, "RTE for RID 0x%x invalid (%04x", ds->devfn, rte); 731 /* Set error bits ? fence ? ... */ 732 return false; 733 } 734 ds->pe_num = rte; 735 return true; 736 } 737 738 static void pnv_phb3_translate_tve(PnvPhb3DMASpace *ds, hwaddr addr, 739 bool is_write, uint64_t tve, 740 IOMMUTLBEntry *tlb) 741 { 742 uint64_t tta = GETFIELD(IODA2_TVT_TABLE_ADDR, tve); 743 int32_t lev = GETFIELD(IODA2_TVT_NUM_LEVELS, tve); 744 uint32_t tts = GETFIELD(IODA2_TVT_TCE_TABLE_SIZE, tve); 745 uint32_t tps = GETFIELD(IODA2_TVT_IO_PSIZE, tve); 746 PnvPHB3 *phb = ds->phb; 747 748 /* Invalid levels */ 749 if (lev > 4) { 750 phb3_error(phb, "Invalid #levels in TVE %d", lev); 751 return; 752 } 753 754 /* IO Page Size of 0 means untranslated, else use TCEs */ 755 if (tps == 0) { 756 /* 757 * We only support non-translate in top window. 758 * 759 * TODO: Venice/Murano support it on bottom window above 4G and 760 * Naples suports it on everything 761 */ 762 if (!(tve & PPC_BIT(51))) { 763 phb3_error(phb, "xlate for invalid non-translate TVE"); 764 return; 765 } 766 /* TODO: Handle boundaries */ 767 768 /* Use 4k pages like q35 ... for now */ 769 tlb->iova = addr & 0xfffffffffffff000ull; 770 tlb->translated_addr = addr & 0x0003fffffffff000ull; 771 tlb->addr_mask = 0xfffull; 772 tlb->perm = IOMMU_RW; 773 } else { 774 uint32_t tce_shift, tbl_shift, sh; 775 uint64_t base, taddr, tce, tce_mask; 776 777 /* TVE disabled ? */ 778 if (tts == 0) { 779 phb3_error(phb, "xlate for invalid translated TVE"); 780 return; 781 } 782 783 /* Address bits per bottom level TCE entry */ 784 tce_shift = tps + 11; 785 786 /* Address bits per table level */ 787 tbl_shift = tts + 8; 788 789 /* Top level table base address */ 790 base = tta << 12; 791 792 /* Total shift to first level */ 793 sh = tbl_shift * lev + tce_shift; 794 795 /* TODO: Multi-level untested */ 796 do { 797 lev--; 798 799 /* Grab the TCE address */ 800 taddr = base | (((addr >> sh) & ((1ul << tbl_shift) - 1)) << 3); 801 if (dma_memory_read(&address_space_memory, taddr, &tce, 802 sizeof(tce), MEMTXATTRS_UNSPECIFIED)) { 803 phb3_error(phb, "Failed to read TCE at 0x%"PRIx64, taddr); 804 return; 805 } 806 tce = be64_to_cpu(tce); 807 808 /* Check permission for indirect TCE */ 809 if ((lev >= 0) && !(tce & 3)) { 810 phb3_error(phb, "Invalid indirect TCE at 0x%"PRIx64, taddr); 811 phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr, 812 is_write ? 'W' : 'R', tve); 813 phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d", 814 tta, lev, tts, tps); 815 return; 816 } 817 sh -= tbl_shift; 818 base = tce & ~0xfffull; 819 } while (lev >= 0); 820 821 /* We exit the loop with TCE being the final TCE */ 822 if ((is_write & !(tce & 2)) || ((!is_write) && !(tce & 1))) { 823 phb3_error(phb, "TCE access fault at 0x%"PRIx64, taddr); 824 phb3_error(phb, " xlate %"PRIx64":%c TVE=%"PRIx64, addr, 825 is_write ? 'W' : 'R', tve); 826 phb3_error(phb, " tta=%"PRIx64" lev=%d tts=%d tps=%d", 827 tta, lev, tts, tps); 828 return; 829 } 830 tce_mask = ~((1ull << tce_shift) - 1); 831 tlb->iova = addr & tce_mask; 832 tlb->translated_addr = tce & tce_mask; 833 tlb->addr_mask = ~tce_mask; 834 tlb->perm = tce & 3; 835 } 836 } 837 838 static IOMMUTLBEntry pnv_phb3_translate_iommu(IOMMUMemoryRegion *iommu, 839 hwaddr addr, 840 IOMMUAccessFlags flag, 841 int iommu_idx) 842 { 843 PnvPhb3DMASpace *ds = container_of(iommu, PnvPhb3DMASpace, dma_mr); 844 int tve_sel; 845 uint64_t tve, cfg; 846 IOMMUTLBEntry ret = { 847 .target_as = &address_space_memory, 848 .iova = addr, 849 .translated_addr = 0, 850 .addr_mask = ~(hwaddr)0, 851 .perm = IOMMU_NONE, 852 }; 853 PnvPHB3 *phb = ds->phb; 854 855 /* Resolve PE# */ 856 if (!pnv_phb3_resolve_pe(ds)) { 857 phb3_error(phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x", 858 ds->bus, pci_bus_num(ds->bus), ds->devfn); 859 return ret; 860 } 861 862 /* Check top bits */ 863 switch (addr >> 60) { 864 case 00: 865 /* DMA or 32-bit MSI ? */ 866 cfg = ds->phb->regs[PHB_PHB3_CONFIG >> 3]; 867 if ((cfg & PHB_PHB3C_32BIT_MSI_EN) && 868 ((addr & 0xffffffffffff0000ull) == 0xffff0000ull)) { 869 phb3_error(phb, "xlate on 32-bit MSI region"); 870 return ret; 871 } 872 /* Choose TVE XXX Use PHB3 Control Register */ 873 tve_sel = (addr >> 59) & 1; 874 tve = ds->phb->ioda_TVT[ds->pe_num * 2 + tve_sel]; 875 pnv_phb3_translate_tve(ds, addr, flag & IOMMU_WO, tve, &ret); 876 break; 877 case 01: 878 phb3_error(phb, "xlate on 64-bit MSI region"); 879 break; 880 default: 881 phb3_error(phb, "xlate on unsupported address 0x%"PRIx64, addr); 882 } 883 return ret; 884 } 885 886 #define TYPE_PNV_PHB3_IOMMU_MEMORY_REGION "pnv-phb3-iommu-memory-region" 887 DECLARE_INSTANCE_CHECKER(IOMMUMemoryRegion, PNV_PHB3_IOMMU_MEMORY_REGION, 888 TYPE_PNV_PHB3_IOMMU_MEMORY_REGION) 889 890 static void pnv_phb3_iommu_memory_region_class_init(ObjectClass *klass, 891 void *data) 892 { 893 IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass); 894 895 imrc->translate = pnv_phb3_translate_iommu; 896 } 897 898 static const TypeInfo pnv_phb3_iommu_memory_region_info = { 899 .parent = TYPE_IOMMU_MEMORY_REGION, 900 .name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION, 901 .class_init = pnv_phb3_iommu_memory_region_class_init, 902 }; 903 904 /* 905 * MSI/MSIX memory region implementation. 906 * The handler handles both MSI and MSIX. 907 */ 908 static void pnv_phb3_msi_write(void *opaque, hwaddr addr, 909 uint64_t data, unsigned size) 910 { 911 PnvPhb3DMASpace *ds = opaque; 912 913 /* Resolve PE# */ 914 if (!pnv_phb3_resolve_pe(ds)) { 915 phb3_error(ds->phb, "Failed to resolve PE# for bus @%p (%d) devfn 0x%x", 916 ds->bus, pci_bus_num(ds->bus), ds->devfn); 917 return; 918 } 919 920 pnv_phb3_msi_send(&ds->phb->msis, addr, data, ds->pe_num); 921 } 922 923 /* There is no .read as the read result is undefined by PCI spec */ 924 static uint64_t pnv_phb3_msi_read(void *opaque, hwaddr addr, unsigned size) 925 { 926 PnvPhb3DMASpace *ds = opaque; 927 928 phb3_error(ds->phb, "invalid read @ 0x%" HWADDR_PRIx, addr); 929 return -1; 930 } 931 932 static const MemoryRegionOps pnv_phb3_msi_ops = { 933 .read = pnv_phb3_msi_read, 934 .write = pnv_phb3_msi_write, 935 .endianness = DEVICE_LITTLE_ENDIAN 936 }; 937 938 static AddressSpace *pnv_phb3_dma_iommu(PCIBus *bus, void *opaque, int devfn) 939 { 940 PnvPHB3 *phb = opaque; 941 PnvPhb3DMASpace *ds; 942 943 QLIST_FOREACH(ds, &phb->dma_spaces, list) { 944 if (ds->bus == bus && ds->devfn == devfn) { 945 break; 946 } 947 } 948 949 if (ds == NULL) { 950 ds = g_new0(PnvPhb3DMASpace, 1); 951 ds->bus = bus; 952 ds->devfn = devfn; 953 ds->pe_num = PHB_INVALID_PE; 954 ds->phb = phb; 955 memory_region_init_iommu(&ds->dma_mr, sizeof(ds->dma_mr), 956 TYPE_PNV_PHB3_IOMMU_MEMORY_REGION, 957 OBJECT(phb), "phb3_iommu", UINT64_MAX); 958 address_space_init(&ds->dma_as, MEMORY_REGION(&ds->dma_mr), 959 "phb3_iommu"); 960 memory_region_init_io(&ds->msi32_mr, OBJECT(phb), &pnv_phb3_msi_ops, 961 ds, "msi32", 0x10000); 962 memory_region_init_io(&ds->msi64_mr, OBJECT(phb), &pnv_phb3_msi_ops, 963 ds, "msi64", 0x100000); 964 pnv_phb3_update_msi_regions(ds); 965 966 QLIST_INSERT_HEAD(&phb->dma_spaces, ds, list); 967 } 968 return &ds->dma_as; 969 } 970 971 static void pnv_phb3_instance_init(Object *obj) 972 { 973 PnvPHB3 *phb = PNV_PHB3(obj); 974 975 QLIST_INIT(&phb->dma_spaces); 976 977 /* LSI sources */ 978 object_initialize_child(obj, "lsi", &phb->lsis, TYPE_ICS); 979 980 /* Default init ... will be fixed by HW inits */ 981 phb->lsis.offset = 0; 982 983 /* MSI sources */ 984 object_initialize_child(obj, "msi", &phb->msis, TYPE_PHB3_MSI); 985 986 /* Power Bus Common Queue */ 987 object_initialize_child(obj, "pbcq", &phb->pbcq, TYPE_PNV_PBCQ); 988 989 } 990 991 void pnv_phb3_bus_init(DeviceState *dev, PnvPHB3 *phb) 992 { 993 PCIHostState *pci = PCI_HOST_BRIDGE(dev); 994 995 /* 996 * PHB3 doesn't support IO space. However, qemu gets very upset if 997 * we don't have an IO region to anchor IO BARs onto so we just 998 * initialize one which we never hook up to anything 999 */ 1000 memory_region_init(&phb->pci_io, OBJECT(phb), "pci-io", 0x10000); 1001 memory_region_init(&phb->pci_mmio, OBJECT(phb), "pci-mmio", 1002 PCI_MMIO_TOTAL_SIZE); 1003 1004 pci->bus = pci_register_root_bus(dev, 1005 dev->id ? dev->id : NULL, 1006 pnv_phb3_set_irq, pnv_phb3_map_irq, phb, 1007 &phb->pci_mmio, &phb->pci_io, 1008 0, 4, TYPE_PNV_PHB3_ROOT_BUS); 1009 1010 object_property_set_int(OBJECT(pci->bus), "phb-id", phb->phb_id, 1011 &error_abort); 1012 object_property_set_int(OBJECT(pci->bus), "chip-id", phb->chip_id, 1013 &error_abort); 1014 1015 pci_setup_iommu(pci->bus, pnv_phb3_dma_iommu, phb); 1016 } 1017 1018 static void pnv_phb3_realize(DeviceState *dev, Error **errp) 1019 { 1020 PnvPHB3 *phb = PNV_PHB3(dev); 1021 PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine()); 1022 int i; 1023 1024 if (phb->phb_id >= PNV_CHIP_GET_CLASS(phb->chip)->num_phbs) { 1025 error_setg(errp, "invalid PHB index: %d", phb->phb_id); 1026 return; 1027 } 1028 1029 /* LSI sources */ 1030 object_property_set_link(OBJECT(&phb->lsis), "xics", OBJECT(pnv), 1031 &error_abort); 1032 object_property_set_int(OBJECT(&phb->lsis), "nr-irqs", PNV_PHB3_NUM_LSI, 1033 &error_abort); 1034 if (!qdev_realize(DEVICE(&phb->lsis), NULL, errp)) { 1035 return; 1036 } 1037 1038 for (i = 0; i < phb->lsis.nr_irqs; i++) { 1039 ics_set_irq_type(&phb->lsis, i, true); 1040 } 1041 1042 phb->qirqs = qemu_allocate_irqs(ics_set_irq, &phb->lsis, phb->lsis.nr_irqs); 1043 1044 /* MSI sources */ 1045 object_property_set_link(OBJECT(&phb->msis), "phb", OBJECT(phb), 1046 &error_abort); 1047 object_property_set_link(OBJECT(&phb->msis), "xics", OBJECT(pnv), 1048 &error_abort); 1049 object_property_set_int(OBJECT(&phb->msis), "nr-irqs", PHB3_MAX_MSI, 1050 &error_abort); 1051 if (!qdev_realize(DEVICE(&phb->msis), NULL, errp)) { 1052 return; 1053 } 1054 1055 /* Power Bus Common Queue */ 1056 object_property_set_link(OBJECT(&phb->pbcq), "phb", OBJECT(phb), 1057 &error_abort); 1058 if (!qdev_realize(DEVICE(&phb->pbcq), NULL, errp)) { 1059 return; 1060 } 1061 1062 /* Controller Registers */ 1063 memory_region_init_io(&phb->mr_regs, OBJECT(phb), &pnv_phb3_reg_ops, phb, 1064 "phb3-regs", 0x1000); 1065 } 1066 1067 void pnv_phb3_update_regions(PnvPHB3 *phb) 1068 { 1069 PnvPBCQState *pbcq = &phb->pbcq; 1070 1071 /* Unmap first always */ 1072 if (memory_region_is_mapped(&phb->mr_regs)) { 1073 memory_region_del_subregion(&pbcq->phbbar, &phb->mr_regs); 1074 } 1075 1076 /* Map registers if enabled */ 1077 if (memory_region_is_mapped(&pbcq->phbbar)) { 1078 /* TODO: We should use the PHB BAR 2 register but we don't ... */ 1079 memory_region_add_subregion(&pbcq->phbbar, 0, &phb->mr_regs); 1080 } 1081 1082 /* Check/update m32 */ 1083 if (memory_region_is_mapped(&phb->mr_m32)) { 1084 pnv_phb3_check_m32(phb); 1085 } 1086 pnv_phb3_check_all_m64s(phb); 1087 } 1088 1089 static Property pnv_phb3_properties[] = { 1090 DEFINE_PROP_UINT32("index", PnvPHB3, phb_id, 0), 1091 DEFINE_PROP_UINT32("chip-id", PnvPHB3, chip_id, 0), 1092 DEFINE_PROP_LINK("chip", PnvPHB3, chip, TYPE_PNV_CHIP, PnvChip *), 1093 DEFINE_PROP_LINK("phb-base", PnvPHB3, phb_base, TYPE_PNV_PHB, PnvPHB *), 1094 DEFINE_PROP_END_OF_LIST(), 1095 }; 1096 1097 static void pnv_phb3_class_init(ObjectClass *klass, void *data) 1098 { 1099 DeviceClass *dc = DEVICE_CLASS(klass); 1100 1101 dc->realize = pnv_phb3_realize; 1102 device_class_set_props(dc, pnv_phb3_properties); 1103 dc->user_creatable = false; 1104 } 1105 1106 static const TypeInfo pnv_phb3_type_info = { 1107 .name = TYPE_PNV_PHB3, 1108 .parent = TYPE_DEVICE, 1109 .instance_size = sizeof(PnvPHB3), 1110 .class_init = pnv_phb3_class_init, 1111 .instance_init = pnv_phb3_instance_init, 1112 }; 1113 1114 static void pnv_phb3_root_bus_get_prop(Object *obj, Visitor *v, 1115 const char *name, 1116 void *opaque, Error **errp) 1117 { 1118 PnvPHB3RootBus *bus = PNV_PHB3_ROOT_BUS(obj); 1119 uint64_t value = 0; 1120 1121 if (strcmp(name, "phb-id") == 0) { 1122 value = bus->phb_id; 1123 } else { 1124 value = bus->chip_id; 1125 } 1126 1127 visit_type_size(v, name, &value, errp); 1128 } 1129 1130 static void pnv_phb3_root_bus_set_prop(Object *obj, Visitor *v, 1131 const char *name, 1132 void *opaque, Error **errp) 1133 1134 { 1135 PnvPHB3RootBus *bus = PNV_PHB3_ROOT_BUS(obj); 1136 uint64_t value; 1137 1138 if (!visit_type_size(v, name, &value, errp)) { 1139 return; 1140 } 1141 1142 if (strcmp(name, "phb-id") == 0) { 1143 bus->phb_id = value; 1144 } else { 1145 bus->chip_id = value; 1146 } 1147 } 1148 1149 static void pnv_phb3_root_bus_class_init(ObjectClass *klass, void *data) 1150 { 1151 BusClass *k = BUS_CLASS(klass); 1152 1153 object_class_property_add(klass, "phb-id", "int", 1154 pnv_phb3_root_bus_get_prop, 1155 pnv_phb3_root_bus_set_prop, 1156 NULL, NULL); 1157 1158 object_class_property_add(klass, "chip-id", "int", 1159 pnv_phb3_root_bus_get_prop, 1160 pnv_phb3_root_bus_set_prop, 1161 NULL, NULL); 1162 1163 /* 1164 * PHB3 has only a single root complex. Enforce the limit on the 1165 * parent bus 1166 */ 1167 k->max_dev = 1; 1168 } 1169 1170 static const TypeInfo pnv_phb3_root_bus_info = { 1171 .name = TYPE_PNV_PHB3_ROOT_BUS, 1172 .parent = TYPE_PCIE_BUS, 1173 .instance_size = sizeof(PnvPHB3RootBus), 1174 .class_init = pnv_phb3_root_bus_class_init, 1175 }; 1176 1177 static void pnv_phb3_register_types(void) 1178 { 1179 type_register_static(&pnv_phb3_root_bus_info); 1180 type_register_static(&pnv_phb3_type_info); 1181 type_register_static(&pnv_phb3_iommu_memory_region_info); 1182 } 1183 1184 type_init(pnv_phb3_register_types) 1185